Merged in feature/download-pdf (pull request #216)

retrieve document by id and tests

* working

* missing files

docs/ai.generated/03-api-documentation.md

@@ -387,6 +387,44 @@ Retrieves enriched document details by ID, including metadata such as folder, fi
 }
 ```
 
+### `GET /document/{id}/download`
+
+Streams the original uploaded document file directly from S3. The response Content-Type is auto-detected from the stored filename extension.
+
+**Security**: Requires JWT authentication
+
+**Path Parameters**:
+
+- `id`: Document UUID (max 36 chars)
+
+**Response** (`200`): Raw file bytes (streamed)
+
+- `Content-Type`: Auto-detected from filename (e.g., `application/pdf`, `image/png`, `application/vnd.openxmlformats-officedocument.wordprocessingml.document`)
+- `Content-Disposition`: `attachment; filename="<original_filename>"`
+- `Content-Length`: File size in bytes
+
+**Error Responses**:
+
+- `400`: Invalid document ID format
+- `401`: Missing or invalid JWT token
+- `404`: Document not found or no S3 entry for the document
+- `500`: S3 retrieval failure
+
+**Example**:
+
+```bash
+curl -H "Authorization: Bearer <token>" \
+     -o report.pdf \
+     http://localhost:8080/document/019580df-ef65-7676-8de9-94435a93337a/download
+```
+
+**Notes**:
+
+- No query parameters needed -- file type is automatically determined from the stored filename
+- Response streams directly from S3, suitable for large files
+- Returns 404 if the document has no stored file (e.g., legacy documents without S3 entries)
+- Supports any file type without code changes (PDF, PNG, DOCX, CSV, etc.)
+
 ### `DELETE /document/{id}`
 
 Permanently deletes a document and all dependent data: document entries, cleans (and their entries), text extractions (and their entries), field extractions (versions and array fields), labels, results, and result dependencies. Source documents in S3 are NOT deleted; their paths are logged and optionally returned.
@@ -1874,6 +1912,7 @@ The following table shows what data is passed to Permit.io for each protected en
 | `POST`                          | `/client/{id}/document`                  | `client`            | `post`   | Upload document         |
 | `GET`                           | `/client/{id}/document`                  | `client`            | `get`    | List client documents   |
 | `GET`                           | `/document/{id}`                         | `document`          | `get`    | Get document details    |
+| `GET`                           | `/document/{id}/download`                | `document`          | `get`    | Download document file  |
 | `DELETE`                        | `/document/{id}`                         | `document`          | `delete` | Hard-delete document (super_admin only) |
 | **Batch Document Operations**   |
 | `POST`                          | `/client/{id}/document/batch`            | `client`            | `post`   | Upload batch (ZIP)      |